The website does get your credentials. To be fair, this is how password login with any of the web clients works as well. Which makes it hazardous to use clients not hosted by the homeserver or a trusted third party.
However, if the homeserver is using OIDC, the user credentials are handled entirely by the external OIDC provider and the client doesn't get them. But then you should be using OIDC directly and not "Sign in with Matrix."
Re:Sign in with Matrix
by driminicus on Tuesday November 16, 2021 @09:34AM
(#29240955)
We are actually working on fixing the password sending issue, see for instance https://github.com/matrix-org/matrix-doc/pull/3262
Of course, untrusted clients can do all kinds of evil things after having authenticated. (And also clients still need the plaintext password at least client-side no matter what we do)
> (And also clients still need the plaintext password at least client-side no matter what we do)
Are matrix devs seriously not aware of what OAuth is and does? That is ... concerning.
Re:Sign in with Matrix
by driminicus on Tuesday November 16, 2021 @02:26PM
(#29245247)
Matrix does actually support OAuth (in fact, the mozilla.org matrix server can only be logged in to through OAuth)
> Do I get some sort of token from their Matrix homeserver
correct
after you sign in, you will get a token, which you can then use to authenticate against matrix home server
Since the form asks for your homeserver, it seems like I'd be typing my password into a form controlled by you, which seems like a bad thing to train people to do?
EDIT: Also, "requires no backend to function" - but if I want to use this to give users access to their data in my backend, how can I do that securely? Do I get some sort of token from their Matrix homeserver that my backend can use to ensure that the client is authenticated as the user they claim to be? Or do I need to pass the username and password to my backend so that my backend can authenticate them with their homeserver?
Don't get me wrong: I love the idea and it's a cool project & great proof-of-concept. I think the current implementation is not secure enough for me to trust. It's possible that I'm mistaken and it actually is secure! But in that case I'd want to see some substantiated argument in the README, explaining how it works & why it's trustworthy.